feat: PG Permission + region (#3567)

cmd/ftl-provisioner-cloudformation/postgres.go

@@ -93,7 +93,16 @@ func PostgresPostUpdate(ctx context.Context, secrets *secretsmanager.Client, byN
 					return fmt.Errorf("failed to create database: %w", err)
 				}
 			}
-			if _, err := db.ExecContext(ctx, "GRANT ALL ON SCHEMA public TO ftluser; GRANT ALL PRIVILEGES ON DATABASE "+resourceID+" TO ftluser;"); err != nil {
+			if _, err := db.ExecContext(ctx, fmt.Sprintf(`
+				GRANT CONNECT ON DATABASE %s TO ftluser;
+				GRANT USAGE ON SCHEMA public TO ftluser;
+				GRANT USAGE ON SCHEMA public TO ftluser;
+                GRANT CREATE ON SCHEMA public TO ftluser;
+				GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO ftluser;
+				GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO ftluser;
+				ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO ftluser;
+				ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO ftluser;
+			`, resourceID)); err != nil {
 				return fmt.Errorf("failed to grant FTL user privileges: %w", err)
 			}
 		}

internal/dsn/dsn.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"net"
+	"strings"
 
 	"github.com/aws/aws-sdk-go-v2/config"
 	"github.com/aws/aws-sdk-go-v2/feature/rds/auth"
@@ -58,9 +59,12 @@ func ResolvePostgresDSN(ctx context.Context, connector schema.DatabaseConnector)
 			return "", fmt.Errorf("configuration error: %w", err)
 		}
 
-		authenticationToken, err := auth.BuildAuthToken(
-			// TODO: proper region
-			ctx, c.Endpoint, "us-west-2", c.Username, cfg.Credentials)
+		region, err := parseRegionFromEndpoint(c.Endpoint)
+		if err != nil {
+			return "", fmt.Errorf("failed to parse region from endpoint: %w", err)
+		}
+
+		authenticationToken, err := auth.BuildAuthToken(ctx, c.Endpoint, region, c.Username, cfg.Credentials)
 		if err != nil {
 			return "", fmt.Errorf("failed to create authentication token: %w", err)
 		}
@@ -74,6 +78,16 @@ func ResolvePostgresDSN(ctx context.Context, connector schema.DatabaseConnector)
 	}
 }
 
+func parseRegionFromEndpoint(endpoint string) (string, error) {
+	host, _, err := net.SplitHostPort(endpoint)
+	if err != nil {
+		return "", fmt.Errorf("failed to split host and port: %w", err)
+	}
+	host = strings.TrimSuffix(host, ".rds.amazonaws.com")
+	parts := strings.Split(host, ".")
+	return parts[len(parts)-1], nil
+}
+
 func ResolveMySQLDSN(ctx context.Context, connector schema.DatabaseConnector) (string, error) {
 	dsnRuntime, ok := connector.(*schema.DSNDatabaseConnector)
 	if !ok {

internal/dsn/dsn_test.go

@@ -0,0 +1,13 @@
+package dsn
+
+import (
+	"testing"
+
+	"github.com/alecthomas/assert/v2"
+)
+
+func TestParseRegionFromEndpoint(t *testing.T) {
+	region, err := parseRegionFromEndpoint("ftl-alice-dbxcluster-rms7cnlwyggg.cluster-cr24kso0s7in.us-west-2.rds.amazonaws.com:5432")
+	assert.NoError(t, err)
+	assert.Equal(t, "us-west-2", region)
+}